twikoo-func 1.7.11 → 1.7.13

package/index.js

@@ -35,7 +35,8 @@ const {
   getConfig,
   getConfigForAdmin,
   validate,
-  checkCommentOwnership
+  checkCommentOwnership,
+  isValidEmail
 } = require('./utils')
 const {
   jsonParse,
@@ -679,6 +680,7 @@ async function parse (comment) {
   const isAdminUser = await isAdmin()
   const isBloggerMail = equalsMail(comment.mail, config.BLOGGER_EMAIL)
   if (isBloggerMail && !isAdminUser) throw new Error('请先登录管理面板，再使用博主身份发送评论')
+  if (comment.mail && !isValidEmail(comment.mail)) throw new Error('邮箱格式不合法')
   const hashMethod = config.GRAVATAR_CDN === 'cravatar.cn' ? md5 : sha256
   const commentDo = {
     uid: await getUid(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.7.11",
+  "version": "1.7.13",
   "description": "A simple comment system.",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",
@@ -24,7 +24,7 @@
     "form-data": "^4.0.0",
     "jsdom": "^16.4.0",
     "marked": "^4.0.12",
-    "nodemailer": "^6.4.17",
+    "nodemailer": "^7.0.11",
     "pushoo": "latest",
     "tencentcloud-sdk-nodejs": "^4.0.65",
     "xml2js": "^0.6.0"

package/utils/index.js

@@ -93,7 +93,7 @@ const fn = {
       downs: downs.length,
       liked: ups.includes(uid),
       disliked: downs.includes(uid),
-      replies: replies,
+      replies,
       rid: comment.rid,
       pid: comment.pid,
       ruser: fn.ruser(comment.pid, comments),
@@ -232,6 +232,17 @@ const fn = {
   isUrl (s) {
     return /^http(s)?:\/\//.test(s)
   },
+  isValidEmail (mail) {
+    if (!mail || typeof mail !== 'string') return false
+    const trimmed = mail.trim()
+    if (!trimmed) return false
+    // Reject emails with characters that could trigger nodemailer addressparser group parsing (CVE-2025-14874)
+    if (trimmed.indexOf(':') !== -1) return false
+    if (trimmed.indexOf(' ') !== -1) return false
+    if (trimmed.indexOf(';') !== -1) return false
+    // Basic email format validation
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(trimmed)
+  },
   isQQ (mail) {
     return /^[1-9][0-9]{4,10}$/.test(mail) ||
       /^[1-9][0-9]{4,10}@qq.com$/i.test(mail)

package/utils/notify.js

@@ -1,4 +1,4 @@
-const { equalsMail, getAvatar } = require('.')
+const { equalsMail, getAvatar, isValidEmail } = require('.')
 const {
   getCheerio,
   getNodemailer,
@@ -115,11 +115,16 @@ const fn = {
           <p>您可以点击<a style="text-decoration:none; color:#12addb" href="${POST_URL}" target="_blank">查看回复的完整內容</a><br></p>
         </div>`
     }
+    const toMail = config.BLOGGER_EMAIL || config.SENDER_EMAIL
+    if (!isValidEmail(toMail)) {
+      logger.warn('博主邮箱格式不合法，跳过发送博主通知：', toMail)
+      return
+    }
     let sendResult
     try {
       sendResult = await transporter.sendMail({
         from: `"${config.SENDER_NAME}" <${config.SENDER_EMAIL}>`,
-        to: config.BLOGGER_EMAIL || config.SENDER_EMAIL,
+        to: toMail,
         subject: emailSubject,
         html: emailContent
       })
@@ -234,6 +239,10 @@ const fn = {
           </div>
         </div>`
     }
+    if (!isValidEmail(parentComment.mail)) {
+      logger.warn('回复通知邮箱格式不合法，跳过发送回复通知：', parentComment.mail)
+      return
+    }
     let sendResult
     try {
       sendResult = await transporter.sendMail({
@@ -262,9 +271,14 @@ const fn = {
         // 邮件测试前清除 transporter，保证读取的是最新的配置
         transporter = null
         await fn.initMailer({ config, throwErr: true })
+        const toMail = event.mail || config.BLOGGER_EMAIL || config.SENDER_EMAIL
+        if (!isValidEmail(toMail)) {
+          res.message = '邮箱格式不合法'
+          return res
+        }
         const sendResult = await transporter.sendMail({
           from: config.SENDER_EMAIL,
-          to: event.mail || config.BLOGGER_EMAIL || config.SENDER_EMAIL,
+          to: toMail,
           subject: 'Twikoo 邮件通知测试邮件',
           html: '如果您收到这封邮件，说明 Twikoo 邮件功能配置正确'
         })